Field
Embodiments of the present invention generally relate to systems and methods for remediating outbound messaging abuse. More specifically, embodiments of the present invention provide for systems and methods of allowing service providers filter outbound subscriber email traffic for spam and/or worm-oriented messages using one or more of individual subscriber email sending reputation, real-time analysis of message content and behavior-based anomaly detection.
Description of Related Art
Reputation has become a new frontier in spam fighting and many different companies have introduced reputation databases that provide insight into the historical email sending behavior of Internet Protocol (IP) addresses or email servers. These new email reputation services also are beginning to provide accreditation services, where email sending organizations that have no email sending history can pay to have one of these services vouch for them, presumably after a fair amount of due diligence has been done by the accrediting service.
Using reputation on the Internet to infer future behavior or to determine access to services is relatively new. However, there have been some implementations, such as EBay's seller reputation or Amazon's rating system for reviewers that have worked fairly well in minimizing participation risk. But, unlike the EBay and Amazon models, the email reputation schemes that have been introduced to the market build their reputation not from individuals, but rather from organizational identifiers, such as IP addresses or domain names.
There are problems with using IP addresses to track email sending behavior. For example, it is fairly common for a message to travel multiple hops before arriving at a recipient's email gateway, thus making it difficult to always identify the true IP address of the originating sender. In fact, as it turns out, those that would be most likely to hide their email sending identity or originating IP address, often will purposely route their messages through several unauthorized gateways.
Meanwhile, because the email protocol does not provide for authentication, domain name reputation for email sending has not had an opportunity to be successful. However, the industry anticipates adopting a protocol extension that will remove fraudulent email envelopes and provide reputation services with a static identity for organizations in which email sending behavior can be associated.
Since IP addresses and domain names are usually tied to organizations, they are often shared by all the end-users within those organizations. Most Internet service providers use dynamic IP addresses for their subscribers, which provide a new IP address with each Internet session. Other service providers and enterprises force their end users to send their messages through authenticated email gateways that have their own shared IP addresses. The lack of persistent identity with IP addresses poses a real risk for email sending reputation, which will mostly be based on transient user behavior.
For organizations with small groups of email senders it is probably okay for their reputation to be tied to a domain name; however, for larger businesses and service providers, this creates an enormous challenge as the organizational reputation is constructed from the aggregate of each individual user's behavior. In some instances, millions of independent end users are responsible for an organization's email sending behavior. Worse yet, an end user's identity can be hijacked by a spam sending virus, thereby compounding the trust problem.